|Summary:||Lockdown kernel patch completely disables BPF syscall|
|Product:||[Fedora] Fedora||Reporter:||Timothée Ravier <tim>|
|Component:||kernel||Assignee:||Kernel Maintainer List <kernel-maint>|
|Status:||CLOSED INSUFFICIENT_DATA||QA Contact:||Fedora Extras Quality Assurance <extras-qa>|
|Version:||29||CC:||airlied, bskeggs, ewk, hdegoede, ichavero, itamar, jarodwilson, jforbes, jglisse, john.j5live, jonathan, josef, jsitnicki, kernel-maint, linville, mchehab, mjg59, pbrobinson, steved|
|Fixed In Version:||Doc Type:||If docs needed, set a value|
|Doc Text:||Story Points:||---|
|Last Closed:||2019-02-21 21:06:23 UTC||Type:||Bug|
|oVirt Team:||---||RHEL 7.3 requirements from Atomic Host:|
|Bug Depends On:|
Description Timothée Ravier 2018-08-28 10:32:13 UTC
Description of problem: Booting Fedora with Secure Boot enabled will result in Lockdown being enabled at boot time. This will completly disable the BPF system call for all users . Unfortunately, this breaks the IPAddressAllow & IPAddressDeny systemd feature . I don't have a solution for this, but as far as I understand, this will also prevent other BPF use-cases (for example: Cilium on Fedora CoreOS).  https://src.fedoraproject.org/rpms/kernel/blob/master/f/efi-lockdown.patch#_1525  https://git.kernel.org/pub/scm/linux/kernel/git/jforbes/linux.git/commit/?h=lockdown&id=0eb0d0851747787f7182b3e9d0d38edb5925a678  https://github.com/systemd/systemd/blob/master/src/core/bpf-firewall.c  https://github.com/systemd/systemd/blob/master/NEWS#L1192  https://www.freedesktop.org/software/systemd/man/systemd.resource-control.html#IPAddressAllow=ADDRESS[/PREFIXLENGTH]%E2%80%A6 How reproducible: Always Steps to Reproduce: 1. Boot Fedora with lockdown enabled (for example: use Secure Boot) Actual results: systemd complains that it can not use the IPAddressAllow & IPAddressDeny features. Expected results: IPAddressAllow & IPAddressDeny features are available.
Comment 1 Timothée Ravier 2018-08-28 10:33:56 UTC
Comment 2 Justin M. Forbes 2018-08-28 20:38:23 UTC
This is a problematic one, but I don't know the real solution just yet. As it stands, I will drop the BPF restriction for the 4.18 rebases, but leave this bug open while I come up with something better.
Comment 3 Justin M. Forbes 2019-01-29 16:13:59 UTC
*********** MASS BUG UPDATE ************** We apologize for the inconvenience. There are a large number of bugs to go through and several of them have gone stale. Due to this, we are doing a mass bug update across all of the Fedora 29 kernel bugs. Fedora 29 has now been rebased to 4.20.5-200.fc29. Please test this kernel update (or newer) and let us know if you issue has been resolved or if it is still present with the newer kernel. If you experience different issues, please open a new bug report for those.
Comment 4 Justin M. Forbes 2019-02-21 21:06:23 UTC
*********** MASS BUG UPDATE ************** This bug is being closed with INSUFFICIENT_DATA as there has not been a response in 3 weeks. If you are still experiencing this issue, please reopen and attach the relevant data from the latest kernel you are running and any data that might have been requested previously.